Fix CORS issues#5696
Open
Pantus Oleh (zibet27) wants to merge 2 commits into
Open
Conversation
Pantus Oleh (zibet27)
requested review from
Aleksei Tirman (Stexxe) and
Bruce Hamilton (bjhham)
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis PR enhances CORS preflight handling and origin port parsing. It adds ApplicationRequest.isCorsPreflightRequest(), a findPortDigitStartIndex() helper used by isValidOrigin/normalizeOrigin (improving IPv6-literal port handling), treats same-origin preflight OPTIONS as handled by CORS, updates KDoc, and adds tests for same-origin preflight and IPv6 origins. ChangesCORS preflight and origin validation
🎯 3 (Moderate) | ⏱️ ~20 minutes
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
ktor-server/ktor-server-tests/common/test/io/ktor/tests/server/plugins/CORSTest.kt (1)
999-1000: ⚡ Quick winUse the repository’s backtick test naming style for the new case.
Please rename this new test to a descriptive backtick form so it matches the test guideline used for new Kotlin tests.
Suggested rename
- fun ipv6LiteralOriginIsAccepted() = testApplication { + fun `accepts bracketed IPv6 origins and rejects malformed ones`() = testApplication {As per coding guidelines, "
**/*Test.{kt,kts}: Prefer descriptive test names in backticks:describe what is being tested."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ktor-server/ktor-server-tests/common/test/io/ktor/tests/server/plugins/CORSTest.kt` around lines 999 - 1000, Rename the test function ipv6LiteralOriginIsAccepted to the repository’s backtick descriptive style (e.g. `ipv6 literal origin is accepted`) by changing the Kotlin function declaration fun ipv6LiteralOriginIsAccepted() to a backticked name (fun `ipv6 literal origin is accepted`()) while keeping the `@Test` annotation and the testApplication body unchanged; locate the function ipv6LiteralOriginIsAccepted in CORSTest.kt and update only its identifier to the backtick form to match the test naming guideline.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ktor-server/ktor-server-plugins/ktor-server-cors/common/src/io/ktor/server/plugins/cors/CORSConfig.kt`:
- Around line 153-155: Update the KDoc in CORSConfig.kt to stop implying
preflight requests always succeed; state that same-origin CORS preflight OPTIONS
requests with Access-Control-Request-Method are still handled/evaluated by the
CORS plugin (not skipped) and may be rejected (e.g., respondPreflight() can
return 403 when the requested method/headers are disallowed). Mention the CORS
plugin's evaluation behavior instead of saying they "receive a successful
response" and keep the language consistent with respondPreflight() and the
plugin's enforcement logic.
In
`@ktor-server/ktor-server-plugins/ktor-server-cors/common/src/io/ktor/server/plugins/cors/CORSUtils.kt`:
- Around line 138-156: The logic in findPortDigitStartIndex has the IPv6 and
non-IPv6 branches swapped; when isIpv6 is true you should look for the closing
']' and then a ':' after that (use ipv6LiteralEndIndex and portSeparatorIndex to
compute port start or origin.length), and when isIpv6 is false you should scan
from hostStartIndex for the first ':' (port), '/' (end of host), or '?'
(malformed) and return the appropriate index or -1; update the branches in
findPortDigitStartIndex accordingly so bracketed IPv6 literals are handled by
the ']' lookup and plain hosts are handled by character scanning.
---
Nitpick comments:
In
`@ktor-server/ktor-server-tests/common/test/io/ktor/tests/server/plugins/CORSTest.kt`:
- Around line 999-1000: Rename the test function ipv6LiteralOriginIsAccepted to
the repository’s backtick descriptive style (e.g. `ipv6 literal origin is
accepted`) by changing the Kotlin function declaration fun
ipv6LiteralOriginIsAccepted() to a backticked name (fun `ipv6 literal origin is
accepted`()) while keeping the `@Test` annotation and the testApplication body
unchanged; locate the function ipv6LiteralOriginIsAccepted in CORSTest.kt and
update only its identifier to the backtick form to match the test naming
guideline.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: e2a69531-4218-4c6f-a3c0-4c838428fac4
📒 Files selected for processing (5)
ktor-server/ktor-server-plugins/ktor-server-cors/common/src/io/ktor/server/plugins/cors/CORS.ktktor-server/ktor-server-plugins/ktor-server-cors/common/src/io/ktor/server/plugins/cors/CORSConfig.ktktor-server/ktor-server-plugins/ktor-server-cors/common/src/io/ktor/server/plugins/cors/CORSUtils.ktktor-server/ktor-server-plugins/ktor-server-cors/common/src/io/ktor/server/plugins/cors/routing/CORS.ktktor-server/ktor-server-tests/common/test/io/ktor/tests/server/plugins/CORSTest.kt
Pantus Oleh (zibet27)
force-pushed
the
zibet27/fix-cors-issues
branch
from
3a86540 to
7fe674e
Compare
Pantus Oleh (zibet27)
force-pushed
the
zibet27/fix-cors-issues
branch
from
7fe674e to
9523c52
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Subsystem
Server CORS
Motivation
KTOR-9659 CORS is skipped when the Origin header contains an IPv6 address
KTOR-9636 CORS plugin drops OPTIONS preflight requests when allowSameOrigin is on
Solution